Remarks 

This Preliminary Amendment cancels without prejudice 
claims 1 to 9 in the underlying PCT Application No. 

PCT/DE03/00526 , and adds without prejudice new claims 10-18. The 
new claims conform the claims to U.S. Patent and Trademark Office 
rules and do not add new matter to the application. 

In accordance with 37 C.F.R. § 1.125(b), the Substitute 
Specification (including the Abstract, but without the claims) 
contains no new matter. The amendments reflected in the 
Substitute Specification (including Abstract) are to conform the 
Specification and Abstract to U.S. Patent and Trademark Office 
rules or to correct informalities. As required by 37 C.F.R. § 
1.121(b) (3) (ii) and §1. 125(c), a Marked Up Version Of The 
Substitute Specification comparing the Specification of record 
and the Substitute Specification also accompanies this 
Preliminary Amendment. Approval and entry of the Substitute 
Specification (including Abstract) are respectfully requested. 

The underlying PCT Application No. PCT/DE03'/00526 
includes an International Search Report, dated August 22, 2003. 
The Search Report includes a list of documents that were 
uncovered in the underlying PCT Application. A copy of the 
Search Report accompanies this Preliminary Amendment. 

It is asserted that the subject matter of the present 
application is new, non-obvious, and useful. Prompt 
consideration and allowance of the Application are respectfully 
requested. 
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SENSOR, CONTROL UNIT, AND METHOD FOR MONITORING AT LEAST 

ONE SENSOR 



Background Inf oi ' mation Field of the Invention 

The invention proceeds from generally relates to a sensor and 
a control unit and a method for monitoring at least one sensor 
5 according to the species defined in the independent claims . 

"Advantages of the Invent i -on Summary of the Invention 

The sensor according to the present invention and control unit 

10 according to the present invention and method for monitoring 
at least one sensor according to the present invention having 
the features of the independent claims have the advantage that 
a differentiated fault pattern can be transmitted with a 
specific fault message to the system i.e. to the control 

15 unit and an appropriate reaction can occur, while 

preventing every fault in a sensor from having the consequence 
that the sensor signal as a whole must not be used, or that 
the system identifies a permanent sensor fault and therefore a 
system, defect . Disruptions that do not denote lasting sensor 

20 damage, and possibly are even attributable to infrequent but 
possible operating states, can therefore be not too severely 
punished. Examples of this are the incoupling of 
electromagnetic interference, and vibrations due to hammer 
blows. The performance or sensitivity of the system is thereby 

25 improved, and the probability of a control unit field failure 
is reduced. The invention in particular makes it possible, 
with adaptation and application to the respective target 
control unit and vehicle, to react better to specific 
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differing system requirements and customer requirements in 
terms of triggering parameters and fault management . 

This allows on the one hand an increase in the performance and 
5 robustness of the overall system, and on the other hand a 

reduction in field failure fates, since with the more in-depth 
fault pattern detection not all fault patterns must be deemed 
total failures. The -invention is additionally advantageous 
because fault discovery and optimization can be facilitated in 
10 the development and testing phase of a restraint system. 

Application of the invention is also possible and advisable, 
however, in other automotive sectors in which sensors are 
used, in particular in vehicle dynamics control and in 
navigation. 

15 

The — featui-es and refinements — s^t^ — forth in the dependent — claims 
make possible — advanfc ageous — improvements to the — sensor , — control 
unit , — and method — for monitoring at — least — one — sensor x"ecited in 
"trtr^ — independent — claims . 

20 

It is particularly advantageous that the status bits 
indicating the fault modes are constituted from different 
sensor- internal monitoring mechanisms, and remain in existence 
only until a conclusion is drawn as to the operating state 

25 belonging to the fault state. The time information for each 
individual fault mode is thus also usable for system- side 
application of the sensor. This permits an accurate analysis 
of the fault, achievable using a so-called look-up table. The 
fault pattern transmitted from the sensor to the control unit 

3 0 can then be evaluated accordingly in the processor of the 

control unit. It is thereby possible, in particular, for the 
control unit to detect whether the fault is permanent and how 
serious the fault is. 

35 It is especially advantageous that the fault pattern is 
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transmitted digitally in an eight-bit word, here given the 
abbreviation MONI, in a 16-bit frame. The MONI word can have 
different fault indications written to it using different read 
instructions. The number of transmittable fault modes can 
5 thereby be increased. In this word, the fault type or modes 

are identified by flags. A variety of fault modes and unusual 
operating states that have been detected are thus indicated by 
way of this word. Fault modes indicate that at least one 
sensor operating parameter is outside a predefined range. 

10 

In the context of this monitoring, advantageously at least one 
phase-lock loop of the sensor and/or at least one control 
voltage is monitored in terms of a predefined range, and/or 
the output values of at least one analog/digital converter are 
15 monitored in terms of a predefined range, and/or the input 

and/or output values of at least one digital/analog converter 
are monitored in terms of a predefined range, and/or the 
dynamic limits of at least one capacitance/voltage converter 
are monitored in terms of a predefined range, and/or at least 

2 0 one offset controller is monitored in terms of a predefined 

range, and/or at least one common-mode controller is monitored 
in terms of departure from a predefined range, and/or at least 
one variable representing a sensor oscillation is monitored in 
terms of a predefined range, and/or impermissible values of at 
25 least one counter are monitored as defined. When a fault or an 
unusual operating state is detected, a respective value is set 
in a respective register, i.e. a fault register is occupied by 
a logical "1". When that fault or unusual operating state is 
no longer detected, the respective register is then reset, 

3 0 i.e. a logical "0" is once again set. 

When at least one value that denotes a fault is set to "1", 
another value ds also set to one. This makes it possible to 
indicate, by way of a single bit or flag, whether any 
35 sensor- internal fault has been identified. This flag is 
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transmitted as status information along with every regular 
sensor output value transmission. If necessary, i.e. in the 
event the summarizing value indicates a fault state, the 
detailed fault pattern can then be requested by way of the 
available read instructions. This procedure of requesting as 
necessary saves transmission and processing capacity. The 
allocation of read instructions numbered 1, 2, etc. to the 
fault infoormation is defined in the MONI word. Two read 
instructions are used here, i.e. two eight-bit words of fault 
information can be indicated. 

It is additionally advantageous that the sensor itself is 
disposed inside the housing of the control unit. SPI (serial 
peripheral interface) lines are then preferably used to 
interconnect the sensor (via the digital interface) and the 
processor of the control unit . 

Drawing Brief Description of the Drawings 

Exemplary entbodiments of the — invention are depicted in the 
drawings and will be explained in more detail — in the 
description below. The present invention will be described in 
greater detail with reference to the following drawings 
wherein: 

The f igures show ; 

FiQure 1 Figure 1 shows a block diagram of the sensqr 
according to the present invention in a control unit according 
to the present invention-; — artd^ 

Figure 2 shows a data telegram according to the present 
invention. 

Detailed Description of the Invention 
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Rotation rate sensors, like other sensors as well, are being 
used more and more in electronic restraint systems for passive 
vehicle safety. Rotation rate sensors are core components for 
the detection of rollover processes and related accident 
5 processes, for example soil trip. 

Some of the sensors used in restraint systems possess a 
sensor- internal monitoring function. A fault or malfunction 
state resulting from a wide variety of causes can, when it is 
10 identified, be reported by way of a logical signal (fault, no 
fault) , in a context of analog sensor interfaces, to the 
system, to a sensor platform, to a control unit that is 
generally a microcontroller, or to a safety semiconductor. 

15 Digital sensors offer the capability, relatively easily 

implemented in technical terms, of transmitting various faults 
and malfunction states to the system by way of permanently 
assigned bits in data words. Each bit has associated with it a 
fault flag, which in turn is associated with a sensor- internal 

20 circuit block or a sensor- internal monitoring variable or 
measured variable. The sensor- internal monitoring function 
generally responds when one of the various sensor- internal 
control voltages or control variables being monitored enters 
the limits of its respective dynamic range or is beyond 

25 design-related value ranges, or when offset values are outside 
permissible ranges, or when a phase- lock loop drops out of 
synchronization, or when counters are found to have an 
overflow or impermissible values. Monitoring is generally 
performed by way of window comparators or by evaluating the 

30 analog/digital converter output or the digital/analog 

converter input word. There are thus a wide variety of causes 
in terms of the sensor evaluation circuit function blocks. 

Possible causes of malfunction or fault states: 
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In rotation rate sensors used in automotive systems, 
vibrational or mechanical disturbance sensitivity is a matter 
of functional principle and is a characteristic property that 
must be accounted for in the sensor application. If there is 
5 no mechanical damping, the performance of these systems is 

limited. A mechanical damper assemblage means a considerable 
additional outlay in terms of development, cost, and 
production. Impacts or severe vibrations can disrupt the 
sensor element so much that the sensor- internal control 

10 systems can no longer engage for a certain period of time, and 
the sensor ends up outside its specified functional range. 
Further possible disturbances are, for example, incoupled 
electromagnetic interference. Faults in the sensor itself or 
in the application wiring can likewise impair system 

15 operation. The effects differ depending on the rotation rate 
sensor fault and the kind of disturbance, and also depending 
on the application environment of the sensor, i.e. the wiring 
and circuit board and the vehicle construction. 

20 The rotation rate sensor monitoring function has hitherto been 
used on the system side only for basic fault detection, i.e. 
is the sensor OK or not. As regards its reaction, the 
restraint system at most distinguishes by way of the duration 
of the fault message whether or not a failure of the rotation 

25 rate sensor exists. That absent, an application in terms of 
coordinating the respective system reaction to the various 
fault messages does not take place. 

Since no classification of different fault patterns is 
30 performed on the system side, and the application environment 
also is not incorporated, the principle of "assuming the 
worst" must be invoked. When the monitoring function 
identifies a state as faulty, the consequence is that the 
sensor signal must not be used, or that the system concludes 
3 5 that a permanent sensor fault and therefore a system defect 
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exists. Malfunctions that do not signify lasting sensor damage 
and are possibly attributable to infrequent but possible 
operating states are therefore generally punished too 
severely. This limits the performance or sensitivity of the 
5 systems, or increases the probability of a possibly 
unnecessary control unit field failure. 

According to the present invention, a fault pattern that 
contains the combination of different fault modes is therefore 
10 transmitted from the sensor to the system, preferably a 

processor of the control unit, thus conveying to the system 
accurate information about the nature and cause of the fault . 
An appropriate reaction by the system to that fault is then 
therefore possible. 

15 

The fault patterns that occur in response to various fault and 
malfunction causes are already determined in the development 
and application phase of restraint system electronics systems. 
With the availability of a look-up table, the system, can react 
20 properly to the particular fault pattern. 

A practical prerequisite for implementation of the invention 
is a digital sensor interface. Only with this can a large 
number of different faults and malfunction modes or patterns, 

25 as well as combinations thereof, be transmitted to the system 
with reasonable outlay. The bidirectional SPI (serial 
peripheral interface) is used here as an example of an 
interface. In this context, for example, two instructions 
RD_MONITOR_I and RD_MONITOR__II are provided for reading out 

30 the various fault modes, the modes themselves being identified 
by way of flags in the MONI word transmitted back in each 
case. The word having eight zeroes, for example, means here 
that the monitored sensor parameter is within specified 
operating ranges, and an unusual operating state does not 

35 exist. The following faults can be indicated by coding: 
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The capacitance/voltage converter in which the measured 
variable is mapped by way of the sensor principle into a 
capacitance or a capacitance change is outside its predefined 
range; the value at the analog/digital converter in the drive 
path, which is an oscillating sensor, is outside its 
predefined range; the phase-lock loop is not synchronized; the 
offset controller is outside its predefined range; the sum 
value and/or difference value of the common-mode control 
circuit in the drive circuit and/or in the detection circuit 
is outside its predefined range; the amplitude of the sensor 
oscillation is outside its predefined range. The drive circuit 
of a rotation rate sensor serves to generate a defined (i.e. 
usually regulated) oscillating or rotational motion with 
which, in the presence of a rotation rate, a measurable ^effect 
(for example, a deflection of a micromechanical structure 
orthogonally to that motion) is generated using e.g. the 
principle of conservation of angular momentum. This effect is 
measured or sensed, and processed, in the detection circuit. 

In addition to these fault indications, an unusual operating 
state can be indicated if the rotation rate value that is 
present exceeds or falls below the measurement range of the 
sensor, and the value must be mapped onto the maximum or 
minimum value that can be represented. 

Figure 1 shows the sensor and the control unit according to 
the present invention in a block diagram. Located in a control 
unit 10 is a sensor 1 that is connected via a digital line 6 
to a processor 7. Processor 7 is connected via a data 
input/output to a memory 8. Processor 7 is connected via a 
data output to the remainder of restraint system 9. A 
so-called safety semiconductor 11, i.e. a further processor or 
a monitoring circuit that also evaluates the sensor output 
values and can influence the enabling of restraint means, can 
be connected to digital line 6. Located in sensor 1 is a 
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sensor element 2 for acquiring a measured variable, e.g. 
rotation rates or rotational accelerations. The sensor element 
can chiefly be a micromechanical sensor structure in which 
drive and detection occur capacitatively . Sensor element 2 is 
5 connected to a functional and monitoring module 3 where 

capacitance/voltage conversion, analog/digital conversion of 
the sensor signal, driving and regulation of the sensor 
oscillation, and sensor- internal monitoring functions can be 
implemented. Functional and monitoring module 3 is connected 
10 via a data output to a transmitter module 4. Transmitter 

module 4 is connected to digital line 6, which is embodied 
here as a so-called SPI (serial peripheral interface) line. 

Functional and monitoring module 3 thus also performs 
15 monitoring functions in sensor 1. The measured values are 

conveyed to transmitter module 5 . At a cycling rate predefined 
by the sensor circuit timing cycle, the fault patterns are 
continuously updated and can be continuously queried. The 
measured values ±n sensor 1 are incorporated into this fault 
20 pattern. 

Figure 2 schematically shows a data frame of the requested, 

16 -bit MISO word, which is subdivided into a first part 12 and 

a second part 11. The respective fault word 11 (MONI) is 

25 transmitted in second part 11. Two fault words, which can be 

read out using different MOSI instructions, can be transmitted 
here. This can occur cyclically or only when necessary. That 
necessity is indicated in the standard rotation rate 
transmission by setting a bit that indicates an unusual 

3 0 operating state. That bit is set when at least one indicatable 
fault instance is deemed to exist. 

Sensor 1 can also, alternatively, be located outside control 
unit 10. Instead of only one sensor 1, several sensors, 
35 possibly of different kinds, can also be used and monitored. 
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In addition to the restraint system discussed here, other 
vehicle systems are also suitable for this invention, for 
example a vehicle dynamics system or a navigation system. 
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Abstract ABSTRACT OF THE DISCLOSURE 



A sensor having a sensor element, and a control unit having a 
processor, and a method for monitoring at least one sensor^ 
are proposed. A fault pattern is generated within the sensor 
and is transmitted from the sensor to the control unit in 
order to enable an appropriate response to the fault pattern 
by the processor. The fault pattern is preferably transmitted 
in an eight-bit word. In addition to' faults, unusual operating 
states are also transmitted. 
(Figure 1) 
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